PoC5 — MARE Security Pipeline

Four FastAPI microservices implementing the Monitoring → Detection → Assessment → Enforcement pipeline for the MARE Intent-Based Network system.

Pipeline overview

Elasticsearch
  └─► Monitoring DOT (:8001)
        └─► Log Analysis DOT (:8002)  [forwards to LOMOS, then →]
              └─► Assessment DOT (:8003)
                    └─► Mitigation DOT (:8004)

Prerequisites

• uv — dependency and venv management
• Docker + Docker Compose — for the shared infrastructure (Elasticsearch, LOMOS)
• Python ≥ 3.11

Initial setup

git submodule update --init --recursive
docker network create poc5-net

Running the PoC demo

Start ElasticSearch Instance

cd ~/devel/mare-poc5

# Start elastic Search
just es-up

Start telemetry replay in a (New Terminal):

cd ~/devel/mare-poc5
just replay

Start the Log Analysis DOT (New Terminal):

cd ~/devel/mare-poc5/dots/loganalysis
just run

Start Monitoring DOT (New terminal):

cd ~/devel/mare-poc5/dots/monitoring
just run

Infrastructure (Elasticsearch)

Start Elasticsearch before any DOT:

docker compose up -d elasticsearch

Health check: curl http://localhost:9200

---

Monitoring DOT

Port: 8001
Role: Polls Elasticsearch for IBN Knowledge Base change logs and telemetry; forwards batches downstream.

cd dots/monitoring
cp .env.sample .env   # set ES_URL and LOGANALYSIS_DOT_URL
uv sync
make dev              # hot-reload; use 'make run' for production

Key env variable	Default	Description
ES_URL	http://localhost:9200	Elasticsearch endpoint
ES_INDEX_INTENT_HISTORY	ibn-intent-history	KB change log index
ES_INDEX_MEASUREMENTS	ibn-measurements	Telemetry index
ES_POLL_INTERVAL_SECONDS	10.0	Polling frequency
LOGANALYSIS_DOT_URL	http://loganalysis-dot:8002	Log Analysis DOT endpoint

Method	Path	Description
GET	/api/v1/health	Liveness probe
GET	/api/v1/snapshots?limit=N	Last N KB snapshots
GET	/api/v1/telemetry?limit=N	Last N telemetry batches

---

Log Analysis DOT

Port: 8002
Role: Receives KB snapshots from the Monitoring DOT, runs them through LOMOS for anomaly scoring, forwards LogAnomalyReport to the Assessment DOT.

cd loganalysis_dot
cp .env.sample .env   # set LOMOS_URL and ASSESSMENT_DOT_URL
uv sync
make dev

Key env variable	Default	Description
LOMOS_URL	http://lomos:5000	LOMOS anomaly detection endpoint
LOMOS_ANOMALY_THRESHOLD	0.5	Minimum score to flag a log line
LOMOS_BATCH_SIZE	500	Max lines per LOMOS request
ASSESSMENT_DOT_URL	http://assessment-dot:8003	Assessment DOT endpoint

Method	Path	Description
GET	/api/v1/health	Liveness probe
POST	/api/v1/events	Receive a KBSnapshot
GET	/api/v1/events	Recent received snapshots
GET	/api/v1/reports	Recent anomaly reports produced

---

Assessment DOT

Port: 8003
Role: Computes a trust_score and severity (LOW / MEDIUM / HIGH / CRITICAL) for each LogAnomalyReport; forwards results meeting the configured threshold to the Mitigation DOT.

cd assessment_dot
cp .env.sample .env   # set MITIGATION_DOT_URL and severity thresholds
uv sync
make dev

Key env variable	Default	Description
SEVERITY_MEDIUM_FRACTION	0.05	Anomalous-line fraction threshold for MEDIUM
SEVERITY_HIGH_FRACTION	0.20	Threshold for HIGH
SEVERITY_CRITICAL_FRACTION	0.50	Threshold for CRITICAL
FORWARD_SEVERITY_THRESHOLD	MEDIUM	Minimum severity to forward
MITIGATION_DOT_URL	http://mitigation-dot:8004	Mitigation DOT endpoint

Method	Path	Description
GET	/api/v1/health	Liveness probe
POST	/api/v1/assessments	Receive a LogAnomalyReport; return AssessmentResult
GET	/api/v1/assessments	Recent results

---

Mitigation DOT

Port: 8004
Role: Final enforcement stage. Logs structured alerts, optionally POSTs to a webhook, and triggers automated network actions for CRITICAL severity events.

cd mitigation_dot
cp .env.sample .env   # set ALERT_WEBHOOK_URL and IBN_API_URL
uv sync
make dev

Key env variable	Default	Description
ALERT_WEBHOOK_URL	(empty)	Webhook for operator alerts (Alertmanager, Slack, etc.)
AUTO_ACTION_SEVERITY	CRITICAL	Minimum severity for automated disconnect
IBN_API_URL	http://ibn:8000	IBN API base URL

Method	Path	Description
GET	/api/v1/health	Liveness probe
POST	/api/v1/mitigations	Receive AssessmentResult and act
GET	/api/v1/alerts	Recent mitigation actions

---

Makefile targets (all DOTs)

Target	Description
make run	Start production server
make dev	Start with hot-reload
make lint	Run ruff check + format
make test	Run pytest suite
make check	Lint + test

---

Full stack via Docker Compose

The DOT services in compose.yaml are commented out pending image stabilisation. To enable them, uncomment the relevant service blocks and run:

docker compose up -d --build

All services share the poc5-net external Docker network.